Old CS:GO Vulnerability Allows Hackers To Take Control Of Your PC

A group of white hat hackers known as the Secret Club recently took to Twitter to point out what seems to be a critical security flaw, found within Source 3D, the game engine of Valve’s popular Counter-Strike: Global Offensive (CS:GO).

According to the group, the bug can be exploited by less-than-savoury hackers to trick gamers who play the game, by sending them a fake Steam invite. Upon accepting the invite, the hackers can then proceed to take over a user’s PC or laptop, effectively locking them out of their machine.

While the existence of the bug is troubling, it isn’t the most alarming aspect of it. Secret Club says that the exploit was reported by one of its members, Florian, back in 2019. Florian said that they had reported the bug to Valve via HackerOne, a bug bounty platform used by the studio that owns Steam. Florian was paid the bounty for its discovery but as per the report, the bug is still there. And it seems that little or next-to-nothing has been done about it.

To that end, the Secret Club accuses Valve of ignoring the problem outright, even after a more recent report this month was filed once more. At the time of writing, Valve still has not commented on the matter.

Clubhouse Announces Privacy Changes To Fix China Spying Vulnerability

Audio-based social media app Clubhouse said it would make privacy changes after US researchers based at Stanford University revealed the app’s potential vulnerability to spying by the Chinese government. The app was recently blocked by China, but Clubhouse officials conceded that conversations involving China nationals that took place before then could go through Chinese servers.

In a statement provided to the Stanford Internet Observatory (SIO), Clubhouse admitted that the pings that the company sent to servers all over the world do contain user’s ID. Even though this only applies to a small part of its traffic, these servers might be located in China as well.

Hence, it will now increase the encryption and blocks within the Clubhouse app to stop it from pinging Chinese servers. The company has also planned to have these new changes to be audited and verified by an external security company.

Earlier, SIO researchers raised concerns that Agora, who provides back-end infrastructure to Clubhouse, might have access to users’ raw audio. SIO surmised that since Agora is subject to China’s cybersecurity laws, the company must turn over recordings to Beijing if requested to do so under national security grounds.

For its part, Agora told The Verge that it does not have access to identifiable user data. The Shanghai-based company also insists that voice and video traffic from non-China users does not go through China.

Beijing blocked Clubhouse last week after Chinese users began using it to discuss taboo topics such as China-Taiwan relations, the ill-treatment of Uighur Muslims in China’s Xinjiang province, and the 1989 Tiananmen Square crackdown.